Inclusion of Sensitive Information in Log Files in go-getter - CVE-2022-29810

Vulnerability identifier: #VU64700

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29810

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to go-getter library can write SSH credentials into its log file. A local user with access to log files can read credentials in clear text, which may lead to privilege escalation or account takeover.

go-getter
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Pak for Watson AIOps
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat OpenShift Container Platform

Install updates from vendor's website.

go-getter - update to 1.5.11
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.11, 2.4.5, 2.5.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0

• https://github.com/hashicorp/go-getter/pull/348
• https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
• https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
• https://bugzilla.redhat.com/show_bug.cgi?id=2080279

• Privilege escalation in HashiCorp go-getter
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2